4 files changed, 87 insertions, 2 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index 53fbcd41e..6f9925b66 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-e346421ca6852fbf9f95cf0e764ecc345e5ce21d
-e346421ca6852fbf9f95cf0e764ecc345e5ce21d
+79d4110c92f82de854b10b2d96df9daaaaeaec3a
+79d4110c92f82de854b10b2d96df9daaaaeaec3a
 971a7653746a6972b907dfe0ce139c06e4a6f482
 971a7653746a6972b907dfe0ce139c06e4a6f482
 openssh_7.4p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index a7a936707..a65e90c78 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,6 +5,7 @@ openssh (1:7.4p1-6) UNRELEASED; urgency=medium
     gone.
   * Document sshd_config changes that may be needed following the removal of
     protocol 1 support from sshd (closes: #851573).
+  * Remove ssh_host_dsa_key from HostKey default (closes: #850614).
 
  -- Colin Watson <cjwatson@debian.org>  Fri, 06 Jan 2017 08:40:14 +0000
 
diff --git a/debian/patches/no-dsa-host-key-by-default.patch b/debian/patches/no-dsa-host-key-by-default.patch
new file mode 100644
index 000000000..cd5bd34a4
--- /dev/null
+++ b/debian/patches/no-dsa-host-key-by-default.patch
@@ -0,0 +1,83 @@
+From 79d4110c92f82de854b10b2d96df9daaaaeaec3a Mon Sep 17 00:00:00 2001
+From: Colin Watson <cjwatson@debian.org>
+Date: Mon, 16 Jan 2017 13:53:04 +0000
+Subject: Remove ssh_host_dsa_key from HostKey default
+
+The client no longer accepts DSA host keys, and servers using the
+default HostKey setting should have better host keys available.
+
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2662
+Bug-Debian: https://bugs.debian.org/850614
+Last-Update: 2017-01-16
+
+Patch-Name: no-dsa-host-key-by-default.patch
+---
+ servconf.c    | 2 --
+ sshd.8        | 7 +++----
+ sshd_config   | 1 -
+ sshd_config.5 | 7 +++----
+ 4 files changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/servconf.c b/servconf.c
+index 1cee3d6c..202c4506 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -204,8 +204,6 @@ fill_default_server_options(ServerOptions *options)
+                /* fill default hostkeys for protocols */
+                options->host_key_files[options->num_host_key_files++] =
+                    _PATH_HOST_RSA_KEY_FILE;
+-               options->host_key_files[options->num_host_key_files++] =
+-                   _PATH_HOST_DSA_KEY_FILE;
+ #ifdef OPENSSL_HAS_ECC
+                options->host_key_files[options->num_host_key_files++] =
+                    _PATH_HOST_ECDSA_KEY_FILE;
+diff --git a/sshd.8 b/sshd.8
+index 38a72540..e8f1fde8 100644
+--- a/sshd.8
++++ b/sshd.8
+@@ -167,11 +167,10 @@ This option must be given if
+ is not run as root (as the normal
+ host key files are normally not readable by anyone but root).
+ The default is
+-.Pa /etc/ssh/ssh_host_dsa_key ,
+-.Pa /etc/ssh/ssh_host_ecdsa_key ,
+-.Pa /etc/ssh/ssh_host_ed25519_key
++.Pa /etc/ssh/ssh_host_rsa_key ,
++.Pa /etc/ssh/ssh_host_ecdsa_key
+ and
+-.Pa /etc/ssh/ssh_host_rsa_key .
++.Pa /etc/ssh/ssh_host_ed25519_key .
+ It is possible to have multiple host key files for
+ the different host key algorithms.
+ .It Fl i
+diff --git a/sshd_config b/sshd_config
+index 13cbe2c6..4aea6c72 100644
+--- a/sshd_config
++++ b/sshd_config
+@@ -16,7 +16,6 @@
+ #ListenAddress ::
+ 
+ #HostKey /etc/ssh/ssh_host_rsa_key
+-#HostKey /etc/ssh/ssh_host_dsa_key
+ #HostKey /etc/ssh/ssh_host_ecdsa_key
+ #HostKey /etc/ssh/ssh_host_ed25519_key
+ 
+diff --git a/sshd_config.5 b/sshd_config.5
+index 703a9cdd..8f8fbb66 100644
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -733,11 +733,10 @@ is not to load any certificates.
+ Specifies a file containing a private host key
+ used by SSH.
+ The defaults are
+-.Pa /etc/ssh/ssh_host_dsa_key ,
+-.Pa /etc/ssh/ssh_host_ecdsa_key ,
+-.Pa /etc/ssh/ssh_host_ed25519_key
++.Pa /etc/ssh/ssh_host_rsa_key ,
++.Pa /etc/ssh/ssh_host_ecdsa_key
+ and
+-.Pa /etc/ssh/ssh_host_rsa_key .
++.Pa /etc/ssh/ssh_host_ed25519_key .
+ .Pp
+ Note that
+ .Xr sshd 8
diff --git a/debian/patches/series b/debian/patches/series
index 7edc511b8..6eae81080 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -28,3 +28,4 @@ regress-integrity-robust.patch
 regress-forwarding-race.patch
 regress-mktemp.patch
 sandbox-x32-workaround.patch
+no-dsa-host-key-by-default.patch